fix: stabilize Dependabot — restore missing package.json, add dependabot.yml, regenerate lockfiles (#815)

* Stabilize Dependabot updates by removing invalid update targets and tightening npm update scope

Agent-Logs-Url: https://github.com/jonobr1/two.js/sessions/cf6e28e3-9973-47b4-8806-5a4c9c7c5ee4

Co-authored-by: jonobr1 <220033+jonobr1@users.noreply.github.com>

* chore: begin Dependabot stabilization plan

Agent-Logs-Url: https://github.com/jonobr1/two.js/sessions/6e86b4bd-5c7f-40c3-8f01-e95d525e29c6

Co-authored-by: jonobr1 <220033+jonobr1@users.noreply.github.com>

* fix: stabilize Dependabot - add dependabot.yml, restore tests/types package.json, regenerate lockfiles, remove package-lock=false

Agent-Logs-Url: https://github.com/jonobr1/two.js/sessions/6e86b4bd-5c7f-40c3-8f01-e95d525e29c6

Co-authored-by: jonobr1 <220033+jonobr1@users.noreply.github.com>

* fix: track tests/typescript/package-lock.json (unignore and commit)

Agent-Logs-Url: https://github.com/jonobr1/two.js/sessions/6e86b4bd-5c7f-40c3-8f01-e95d525e29c6

Co-authored-by: jonobr1 <220033+jonobr1@users.noreply.github.com>

* Remove test script from tests/types package.json

Delete the scripts section that defined the "test" script ("jest") from tests/types/package.json. The updated file also no longer has a trailing newline.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jonobr1 <220033+jonobr1@users.noreply.github.com>
Co-authored-by: Jono Brandel <developer@jono.fyi>

Author: Copilot

.github/dependabot.yml

@@ -0,0 +1,46 @@
+version: 2
+
+updates:
+  # Root npm package
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        patterns:
+          - "*"
+
+  # tests/types npm package
+  - package-ecosystem: "npm"
+    directory: "/tests/types"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        patterns:
+          - "*"
+
+  # tests/typescript npm package
+  - package-ecosystem: "npm"
+    directory: "/tests/typescript"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        patterns:
+          - "*"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/lint.yml

@@ -13,3 +13,32 @@ jobs:
       run: npm ci
     - name: Run ESLint
       run: npm run lint
+
+  check-dependency-files:
+    name: Check dependency manifest/lockfile pairs
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5
+    - name: Verify each Dependabot-managed npm directory has package.json and package-lock.json
+      shell: bash
+      run: |
+        dirs=("." "tests/types" "tests/typescript")
+        ok=true
+        for dir in "${dirs[@]}"; do
+          if [ ! -f "$dir/package.json" ]; then
+            echo "ERROR: $dir/package.json is missing"
+            ok=false
+          fi
+          if [ ! -f "$dir/package-lock.json" ]; then
+            echo "ERROR: $dir/package-lock.json is missing"
+            ok=false
+          fi
+        done
+        if [ "$ok" != "true" ]; then
+          echo ""
+          echo "Every npm directory managed by Dependabot must contain both"
+          echo "package.json and package-lock.json. Run 'npm install' in the"
+          echo "affected directory and commit the result."
+          exit 1
+        fi
+        echo "All dependency file pairs are present."

.gitignore

@@ -6,7 +6,6 @@ docs.json
 dist
 .idea
 .codacy
-tests/typescript/package-lock.json
 
 #Ignore vscode AI rules
 .github/instructions/codacy.instructions.md